token create command creates a new token that can be used for
authentication. This token will be created as a child of the currently
authenticated token. The generated token will inherit all policies and
permissions of the currently authenticated token unless you explicitly define a
subset list policies to assign to the token.
A ttl can also be associated with the token. If a ttl is not associated with the token, then it cannot be renewed. If a ttl is associated with the token, it will expire after that amount of time unless it is renewed.
Metadata associated with the token (specified with
-metadata) is written to
the audit log when the token is used.
If a role is specified, the role may override parameters specified here.
Create a token attached to specific policies:
$ vault token create -policy=my-policy -policy=other-policyKey Value--- -----token 95eba8ed-f6fc-958a-f490-c7fd0eda5e9etoken_accessor 882d4a40-3796-d06e-c4f0-604e8503750btoken_duration 768htoken_renewable truetoken_policies [default my-policy other-policy]
Create a periodic token:
$ vault token create -period=30mKey Value--- -----token fdb90d58-af87-024f-fdcd-9f95039e353atoken_accessor 4cd9177c-034b-a004-c62d-54bc56c0e9bdtoken_duration 30mtoken_renewable truetoken_policies [my-policy]
The following flags are available in addition to the standard set of flags included on all commands.
(string: "")- Print only the field with the given name. Specifying this option will take precedence over other formatting directives. The result will not have a trailing newline making it ideal for piping to other processes.
(string: "table")- Print the output in the given format. Valid formats are "table", "json", or "yaml". This can also be specified via the
(string: "")- Name to associate with this token. This is a non-sensitive value that can be used to help identify created secrets (e.g. prefixes).
(duration: "")- Explicit maximum lifetime for the token. Unlike normal TTLs, the maximum TTL is a hard limit and cannot be exceeded. This is specified as a numeric string with suffix like "30s" or "5m".
(string: "")- Value for the token. By default, this is an auto-generated value. Specifying this value requires sudo permissions.
(k=v: "")- Arbitrary key=value metadata to associate with the token. This metadata will show in the audit log when the token is used. This can be specified multiple times to add multiple pieces of metadata.
(bool: false)- Detach the "default" policy from the policy set for this token.
(bool: false)- Create the token with no parent. This prevents the token from being revoked when the token which created it expires. Setting this value requires sudo permissions.
(duration: "")- If specified, every renewal will use the given period. Periodic tokens do not expire as long as they are actively being renewed (unless
-explicit-max-ttlis also provided). Setting this value requires sudo permissions. This is specified as a numeric string with suffix like "30s" or "5m".
(string: "")- Name of a policy to associate with this token. This can be specified multiple times to attach multiple policies.
(bool: true)- Allow the token to be renewed up to it's maximum TTL.
(string: "")- Name of the role to create the token against. Specifying -role may override other arguments. The locally authenticated Vault token must have permission for
(duration: "")- Initial TTL to associate with the token. Token renewals may be able to extend beyond this value, depending on the configured maximumTTLs. This is specified as a numeric string with suffix like "30s" or "5m".
(string: "service")- The type of token to create. Can be "service" or "batch".
(int: 0)- Number of times this token can be used. After the last use, the token is automatically revoked. By default, tokens can be used an unlimited number of times until their expiration.